replace deploy-rs CI with Comin pull-based deployment

- Add Comin service for cryodev-main (polls git repo, auto-deploys)
- Fix cryodev-pi Comin URL (cryodev-server.git -> cryodev.git)
- Remove deploy-rs from CI pipeline (was insecure with shared runner)
- Remove deploy SSH key, root SSH login, sudo rules for gitea-runner
- Revert PermitRootLogin back to 'no'
- CI now only runs flake-check + build (no deploy)
- Deployment happens via Comin (both hosts poll and self-deploy)

.forgejo/workflows/deploy.yml

@@ -15,38 +15,18 @@ jobs:
       - name: Run flake check
         run: nix flake check --impure
 
-  deploy-cryodev-main:
+  build-hosts:
     needs: flake-check
     runs-on: host
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Set up SSH
-        env:
-          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
-        run: |
-          # Write key to a shared location readable by nix-daemon
-          sudo mkdir -p /etc/deploy
-          echo "$DEPLOY_KEY" | sudo tee /etc/deploy/key > /dev/null
-          sudo chmod 600 /etc/deploy/key
+      - name: Build cryodev-main
+        run: nix build .#nixosConfigurations.cryodev-main.config.system.build.toplevel --impure
 
-          # Global SSH config so both the runner and nix-daemon can use it
-          sudo tee /etc/ssh/ssh_config.d/deploy.conf > /dev/null << 'EOF'
-          Host cryodev.xyz
-            Port 2299
-            User root
-            IdentityFile /etc/deploy/key
-            StrictHostKeyChecking accept-new
-          EOF
-
-      - name: Deploy with deploy-rs
-        run: nix run github:serokell/deploy-rs -- -s .#cryodev-main
-
-      - name: Clean up SSH
-        if: always()
-        run: |
-          sudo rm -f /etc/deploy/key /etc/ssh/ssh_config.d/deploy.conf
+      - name: Build cryodev-pi
+        run: nix build .#nixosConfigurations.cryodev-pi.config.system.build.toplevel --impure
 
   build-pi-images:
     needs: flake-check